ipsec.pdb
Static task
static1
1 signatures
General
-
Target
abac13581cf0ab762cc4687b03fc236e
-
Size
73KB
-
MD5
abac13581cf0ab762cc4687b03fc236e
-
SHA1
bf9724f22aa108db7667f0e2dfcab4e5223a2aee
-
SHA256
0b98f517ea298986936b082ce7955f43c408dc9371155bd5c30f90766787b782
-
SHA512
f88fa0f6f214502dc7039cd97dbf57db97d84c8cf3b47d7aa35b5e2a05a962b62873999497e478eb62b0345d6ffd54d76cf74b77699f8606875f267b6a5d9f50
-
SSDEEP
768:AOFn+koR1/KUJbxoki0pRsgFfin8x4Bu+7tstQACXn4RIcF55Sv1dw7MVRW44cfp:ZnSRq5GbE8x4BZstQiFuuMe4f4
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource abac13581cf0ab762cc4687b03fc236e
Files
-
abac13581cf0ab762cc4687b03fc236e.sys windows:5 windows x86 arch:x86
3b838288bb06dd95d5d887532fb636c6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
hal
KfAcquireSpinLock
KfReleaseSpinLock
KfLowerIrql
ndis.sys
NdisCancelTimer
NdisWriteEventLogEntry
NdisSetTimer
NdisInitializeTimer
ntoskrnl.exe
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
IoGetDeviceObjectPointer
IofCompleteRequest
KeQuerySystemTime
RtlExtendedIntegerMultiply
ZwClose
MmIsThisAnNtAsSystem
ExInitializeNPagedLookasideList
IoDeleteDevice
IoDeleteSymbolicLink
KeDelayExecutionThread
IoAcquireCancelSpinLock
IoCreateSymbolicLink
IoCreateDevice
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
ObfDereferenceObject
RtlAnsiStringToUnicodeString
RtlIntegerToUnicodeString
IoReleaseCancelSpinLock
KeTickCount
KeBugCheckEx
wcslen
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
MmBuildMdlForNonPagedPool
MmSizeOfMdl
ExDeleteNPagedLookasideList
KeInitializeSpinLock
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
InterlockedPushEntrySList
memmove
ExQueueWorkItem
_allshl
MmMapLockedPagesSpecifyCache
ExInitializeResourceLite
ExDeleteResourceLite
ZwDeviceIoControlFile
ZwLoadDriver
ZwCreateFile
RtlSplay
RtlDelete
KeCancelTimer
_alldiv
KeSetTimerEx
KeInitializeTimer
KeInitializeDpc
KeQueryTimeIncrement
ExInterlockedAddLargeStatistic
InterlockedPopEntrySList
Sections
.text Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 976B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ